Description
resolvePartial() in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted with a string value whose key matches a partial reference in a template, the polluted string is used as the partial body and rendered without HTML escaping, resulting in reflected or stored XSS.
Recommendation
Update the handlebars package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 4.7.9
- Patched version(s): 4.7.9
References
Could your website be exposed too?
SmartScanner can check your website for Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block - CVE-2026-33938
- Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial - CVE-2026-33940
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
You might also like:
See something that needs correcting? Let us knowUpdated March 27, 2026